## 🚨 A Trusted Ad Script Just Got Weaponized to Steal Crypto
No phishing email. No malicious download. Just a routine ad-tracking script, on thousands of legitimate sites, silently swapping crypto wallet addresses — and every antivirus engine missed it.
What happened:
Adform, an adtech platform used by ~14,000 businesses, had its core tracking script (trackpoint-async.js) hijacked in a supply chain attack.
The payload:
- Polled victims' clipboards every few seconds for BTC/ETH/TRON wallet addresses
- Silently swapped the copied address with an attacker-controlled one
- Re-overwrote it again if the victim caught the swap and re-copied the correct address
- Logged victim IPs + browsing paths to a C2 server
The scary part: submitted to VirusTotal, all 61/61 engines returned clean. 🚩
This isn't a vendor failure — it's a structural blind spot. Reputation-based detection flags known-bad infra. A script served from a trusted, high-traffic domain doesn't fit that profile, even when trojanized.
Why it matters for devs:
If you embed any third-party ad/analytics script, this is a solid case for:
I wrote up the full attack chain, IOCs, detection steps, and prevention controls here:
🔗 https://www.xpert4cyber.com/2026/08/adform-hack-crypto-stealer-ad-script.html
Worth a read if you maintain any production site with third-party scripts.
Top comments (0)